wp-playground-bot

Code Review Skills — Evidence-Based Security Review Patterns

This gist bundles 20 security-focused code review skills as a single reference. Files are numbered 01- through 20- to match the ordering below.

20 code review skills extracted from the analysis of 300+ real-world bugs in major open source projects (200 missed in review, 106 caught before exploitation). Each skill is grounded in specific CVEs, security advisories, published audit findings, and documented review processes from projects including the Linux kernel, OpenSSL, Chromium, Firefox, curl, Go, Rust, Kubernetes, and dozens more.

schacon

#!/bin/bash

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
NO_COLOR='\033[0m'
BLUE='\033[0;34m'
YELLOW='\033[0;33m'
NO_COLOR='\033[0m'

oskosk

1. Create a JN site with ?gutenberg&jetpack
2. SSH into it.
3. Run curl https://gist.githubusercontent.com/oskosk/1b821e70548b065cef1d9c8e6f786089/raw/build-gutenpack.sh --output build-gutenpack.sh && source build-gutenpack.sh
4. Check the Gutenberg demo page and confirm that the Markdown block is present on the Inserter.

blowery

const namer = "hanz";
export default namer;

import b from './b';
console.log( 'starting a' );

function combo() {
    return b + 'a';
}

tyxla

find . -type f -exec perl -0777 -i -p -e 's/(import[^\n\r]+)[\n\r]{2,}(import[^\n\r]+)/\1\n\2/igs' {} +

egmontkob

Hyperlinks (a.k.a. HTML-like anchors) in terminal emulators

[ Update 2025-03-24: Commenting is disabled permanently. Previous comments are archived at web.archive.org. ]

---

Most of the terminal emulators auto-detect when a URL appears onscreen and allow to conveniently open them (e.g. via Ctrl+click or Cmd+click, or the right click menu).

It was, however, not possible until now for arbitrary text to point to URLs, just as on webpages.

sirreal

Make it easy to include SVG strings inline via node-sass.

Escapes SVG (via encodeURIComponent + node-sass custom function).

Wraps <svg/> with appropriate url(data...) which I can never remember.

Call:

node-sass --source-map=true --functions=./node-sass-functions.js in.scss out.css

jaredly

<script>
    __REACT_DEVTOOLS_GLOBAL_HOOK__ = parent.__REACT_DEVTOOLS_GLOBAL_HOOK__
</script>
<script src="vendor.js"></script>
<script>
    window.React = parent.React = require('react')
    window.onload = function() {
    React.render(React.createElement('strong', null, 'hello'), document.body)
    }
</script>

silv3rm00n

<?xml version="1.0"?>
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
<fontconfig>

	<!--
		Documented at
		http://linux.die.net/man/5/fonts-conf
			
		To check font mapping run the command at terminal
		$ fc-match 'helvetica Neue'